What is the EU’s Cloud Sovereignty Framework and will it be enough? | Tech Radar

Overview

News, deals, reviews, guides and more on the newest computing gadgets

Start exploring exclusive deals, expert advice and more

Details

Unlock and manage exclusive Techradar member rewards.

Unlock instant access to exclusive member features.

Get full access to premium articles, exclusive features and a growing list of member rewards.

What is the EU’s Cloud Sovereignty Framework and will it be enough?

The Cloud Sovereignty Framework: measurable progress or missed opportunity?

When you purchase through links on our site, we may earn an affiliate commission. Here’s how it works.

Chips from Taiwan, oil from the Persian Gulf, and cars from Germany – what was long taken for granted is now being called into question all over the world. Where markets and expertise are concentrated among a few providers, enormous economies of scale arise.

At the same time, however, dependencies also grow – often with risks that only become apparent when supplies fail, prices rise, demand evolves, policies change, or individual players begin to monopolize the market.

Take AI, for example – according to research institute, Epoch AI, only two notable AI models have emerged in Europe over the past twenty years compared to 50 in the US and 30 in China. The technology has moved so quickly that the repercussions of this imbalance are only just beginning to be felt in European markets.

From office applications to storage and computing resources to software, what providers deliver from their data centers in a highly scalable, maximally available, and extremely innovative manner does not, in most cases, originate from the European continent.

According to Bitkom’s Cloud Report 2026, roughly 85% of German companies consider Germany to be too dependent on US providers, and almost two thirds of local users (64%) feel compelled to review their own IT strategy due to US government policy. Countries like France are already taking action, with the French government announcing plans to replace Windows with Linux on its government computers.

Zscaler’s Casper Klynge on the question of European sovereignty, the transatlantic relationship, and the future of AI

EU reveals new plans to cut reliance on US and Chinese tech

At the same time, the national health insurance fund has already migrated 80,000 employees from Microsoft Teams, Zoom, and Dropbox to its own alternatives.

Whether in Germany or France, the question of how digitally dependent companies, governments, and societies are on individual suppliers is being asked throughout Europe. And it has been for some time. While Gaia-X focused on common standards for sovereign cloud computing, the EU is now pursuing a more pragmatic approach.

The Cloud Sovereignty Framework (CSF), unveiled in October 2025, aims to make digital sovereignty measurable. To achieve this, it builds on initiatives such as Gaia-X as well as regulations like DORA and NIS2, with the ultimate goal of being able to prioritize compliant, low-risk providers in public procurement.

Controlling and regionally consolidating one’s own digital traffic flows. That’s quite a task in a world where AI superpowers are evolving overseas. With regard to IT supply chains, the framework favors providers who operate their environments in a transparent, resilient, and sufficiently sovereign manner to ensure that systems are protected from external influences or the interests of third parties.

This means, for example, that data paths must be traceable and controllable at the regional level to ensure they remain within the EU legal framework. In other words, there is no sovereign cloud without an interconnection strategy. After all, Internet Exchanges (IXs) already play a key role when it comes to processing bits and bytes locally. Wherever companies, networks, and clouds connect at IXs, they exchange information along paths that can be precisely defined geographically.

Keeping your options open: Why choice matters for UK AI sovereignty

Although the EU does not explicitly make IXs a scoring criterion, it’s heavily implied. For example, the CSF also evaluates cloud services based on supply chain-related legal, operational, and technological objectives. This concept is also reflected in the NIS2 Directive and argues in favor of more decentralized and resilient backbones, such as mutually secured interconnection platforms, such as IXs.

In practical terms, this means that any IT landscape is only as secure as the individual elements that comprise it. So, if all partners design the components they provide to others with multiple layers of redundancy, the overall system becomes not only more reliable but also more independent for everyone.

Distributed and provider-neutral IXs have already made this principle their guiding philosophy: to allow data to be exchanged with high availability, security, and control – between all companies, partners, and clouds within the digital ecosystem.

Technical issues can usually be resolved easily, but legal ones often cannot. Therefore, the CSF is unlikely to revolutionize the European cloud market overnight, but it can steer public demand in a targeted manner. As a result, hybrid, multi-cloud, and on-premises approaches are becoming more important, and IT is becoming infinitely more complex.

While unravelling this complexity will take additional effort, the pay-off of rearchitecting networks around neutral IXs will be a two for one: not only will it reduce long-term lock-in risks but will also reduce the threat of having to pay significantly higher prices later on when things inevitably change. Europe must now consciously accept this and align and strengthen its own provider market accordingly.

Just as operations would come to a standstill for 46% of companies in a prolonged outage, without the cloud, there can be no functional public administration – and no independent, sovereign, and thus capable state.

This article was produced as part of Tech Radar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today.

The views expressed here are those of the author and are not necessarily those of Tech Radar Pro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit

You must confirm your public display name before commenting

'We stop thinking about the data that we're giving away because it's cool' — Smart tech and the decline of public privacy

Tottenham Hotspur ditches VMWare in favor of HPE — cuts licensing costs by 85 percent

Amid rising DDR5 costs, Team Group T-Force 64GB RAM hits $820 at Newegg

I just saw a lawnbot with a mechanical arm that reaches out to hand-trim your edges

The highlight of JLab's IFA launch is super-cheap, super-small ANC earbuds with proprietary Apple tech to replace the Air Tag on your keychain

Tech Radar is part of Future US Inc, an international media group and leading digital publisher. Visit our corporate site.

Key Takeaways

News, deals, reviews, guides and more on the newest computing gadgets
Start exploring exclusive deals, expert advice and more
Unlock and manage exclusive Techradar member rewards
Unlock instant access to exclusive member features
Get full access to premium articles, exclusive features and a growing list of member rewards